Micronaut CORS configuration does not expose the specified header(s)

Expected Behavior

When exposing the Location header via the CORS configuration in application.yml, I expect the header to be accessible in front-end scripts.

Actual Behaviour

When exposing the Location header via the CORS configuration in application.yml, the header is NOT accessible in front-end scripts.

Steps To Reproduce

1. Clone the repository
2. Start up a Keycloak authentication server with the given realm-export.json file
3. Start up the Micronaut application
4. Open the given index.html file in your browser
5. See that the Location header is NOT logged to the console
6. If you change the version to 3.7.2 and update micronaut-security-jwt and micronaut-security-oauth2 to use 3.8.0, I can see the Location header

Environment Information

• Operating System: macOS Ventura 13.0
• JDK (I assume this issue would still occur with JDK 17): openjdk 20-ea 2023-03-21 OpenJDK Runtime Environment (build 20-ea+21-1545) OpenJDK 64-Bit Server VM (build 20-ea+21-1545, mixed mode, sharing)

Example Application

https://github.com/lbkulinski/micronaut-3.7.3-regression

Version

3.7.3

[sdelamo]

@lbkulinski 3.8.2 fixes this https://github.com/micronaut-projects/micronaut-security/releases/tag/v3.8.2

[lbkulinski]

@yawkat

docker run -d -p 8543:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=password quay.io/keycloak/keycloak:19.0.2 start-dev

You can then access the admin console by going to http://localhost:8543/admin/master/console/#/. For some reason I have to reload that page to get the login screen. The username and password are those mentioned in the command. From there, you can create a new realm with the given configuration.